hhhai

20252026

Critical

High

Medium

Low

Global Rank

#111

of 3,238 researchers

Vulns

51

Critical2

High22

Medium27

Low0

Affected Assets

46

46plugins

Avg CVSS

6.5

Average score of vulnerabilities

Researcher Submissions

48 records


2026-07-24 00:00	Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces <= 7.6.1 - Unauthenticated Stored Cross-Site Scripting Product Feed Manager For WooCommerce <= 7.6.1	`CVE-2026-59553`	7.2 High	hhhai	Yes
2026-07-23 00:00	PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting PeproDev Ultimate Invoice <= 2.2.6	`CVE-2026-65510`	7.2 High	hhhai	No
2026-07-16 00:00	Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting Form Vibes <= 1.5.2	`CVE-2026-61947`	7.2 High	hhhai	Yes
2026-07-08 00:00	SureDash – Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (SureDash User+) Arbitrary File Deletion SureDash <= 1.8.0	`CVE-2026-57401`	8.1 High	hhhai	Yes
2026-07-08 00:00	Active Products Tables for WooCommerce. Use constructor to create tables <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting Active Woot Products Tables for WooComm… <= 1.1.0	`CVE-2026-57409`	7.2 High	hhhai	Yes
2026-07-08 00:00	Flexible Refund for WooCommerce – EU One Click Return <= 1.0.51 - Authenticated (Customer+) Stored Cross-Site Scripting Flexible Refund for WooCommerce <= 1.0.51	`CVE-2026-57402`	6.4 Medium	hhhai	Yes
2026-07-07 00:00	WPJAM Basic <= 7.0 - Authenticated (Contributor+) PHP Object Injection WPJAM Basic <= 7.0	`CVE-2026-57371`	7.5 High	hhhai	Yes
2026-07-02 19:22	LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step Appointment Booking Plugin <= 5.6.1	`CVE-2026-11398`	5.3 Medium	hhhai	Yes
2026-06-29 00:00	Booktics <= 1.0.21 - Unauthenticated PHP Object Injection Booktics <= 1.0.21	`CVE-2026-57621`	8.1 High	hhhai	Yes
2026-06-26 00:00	WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 - Authenticated (Contributor+) SQL Injection WP Post Author <= 3.9.1	`CVE-2026-57643`	6.5 Medium	hhhai	Yes

Showing 1–10 of 48 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C